What Is an On-Path Attack?

What is an On-Path Attack – on-path-attack

What is an on-path attacker?

On-path attackers position themselves between two devices (usually a web browser and a web server) and intercept or modify communications between the two devices. Attackers can then collect information as well as impersonate either of the parties. In addition to websites, these attacks can target email communications, DNS lookups, and public WiFi networks. Typical targets of on-path attackers include SaaS companies, e-commerce companies, and users of financial applications.

You can think of an on-path attacker like a corrupt mail carrier sitting in a post office and intercepting letters written between two people. The mail carrier can read private messages and even edit the contents of those messages before passing them on to the intended recipients.

For example:

An on-path attacker can sit between a user and the website they want to visit, collecting the user's username and password. This can be done by targeting the HTTP connection between the user and the website; compromising this connection allows the attacker to act as a proxy, collecting and modifying information sent between the user and the site. Alternatively, the attacker can steal the user's cookies (small pieces of data created by a website and stored on the user's computer for identification and other purposes). These stolen cookies can be used to hijack the user's session, allowing the attacker to impersonate that user on the site.

Also:

On-path attackers can also target DNS servers. A DNS lookup is what allows web browsers to find websites by translating domain names into IP addresses. In on-path DNS attacks such as DNS spoofing and DNS hijacking, an attacker can compromise the DNS lookup process and send users to the wrong sites, often sites that distribute malware and/or collect sensitive information.

What is email hijacking?

Another common attack is email hijacking, which on-path attackers use to infiltrate email servers by positioning themselves between the email server and the web. Once the server is compromised, attackers can monitor email communications for various purposes. One such scam involves waiting for a scenario where someone needs to transfer money to another person (for example, a customer paying a company). Attackers can then use a spoofed email address to request that the funds be transferred to the attacker's account. The email will appear legitimate and harmless to the recipient (“Sorry, there was a typo in my last email! My account number is actually: XXX-XXXX”) making this attack highly effective and financially devastating. In 2015, a cybercrime gang in Belgium used email hijacking to steal more than 6 million euros from various European companies.

Why is using public WiFi networks risky?

On-path attacks are often carried out over WiFi networks. Attackers can create malicious WiFi networks that appear either harmless or cloned from legitimate WiFi networks. Once a user connects to the compromised WiFi network, the on-path attacker can monitor that user's online activity. Sophisticated attackers may redirect the user's browser to fake versions of legitimate websites.

What are the methods for protecting against on-path attackers?

Because on-path attackers use a number of techniques, there is no one-size-fits-all solution to these attacks. One of the primary methods of protection against attacks targeting HTTP traffic is the adoption of SSL/TLS, which establishes secure connections between users and web services. Unfortunately, this is not a guaranteed solution, as more sophisticated on-path attackers can work around SSL/TLS protection. For additional protection against these types of attacks, some web services implement HTTP Strict Transport Security (HSTS), which enforces secure SSL/TLS connections with any browser or application, prevents any insecure HTTP connections, and also prevents cookie theft.

Authentication certificates can also be used for protection against these attacks. An organization can implement certificate-based authentication on all its devices, so that only users with properly configured certificates can access their system.

To prevent email hijacking, Secure/Multipurpose Internet Mail Extensions (S/MIME) can be used. This protocol encrypts email messages and allows users to digitally sign emails using a unique digital certificate, enabling recipients to verify that the message is legitimate.

Individual users can also protect themselves from on-path attackers by avoiding sending any sensitive information over any public WiFi network unless it is protected by a secure Virtual Private Network (VPN).